Bug#963525: steam: crashes with libmount version that depends on libcryptsetup12

[Simon McVittie]

Control: retitle -1 steam: crashes with libmount version that depends on libcryptsetup12
Control: forwarded -1 https://github.com/ValveSoftware/steam-for-linux/issues/7223

Thanks to everyone who added information here.

I think what's happening here is a conflict between the mystery version
of OpenSSL that is statically linked into the Steam binary, and the
shared-library version that is (newly) pulled in via the dependency
chain of GLib -> libmount -> libcryptsetup. That's consistent with the
backtrace that Reiner provided.

Because this is a fact about the binary-only, proprietary Steam executable
rather than a fact about the packaging, it's not unexpected that it
applies equally to Debian's steam package and Valve's steam-launcher
package. Both of those packages only contain the "Steam bootstrapper":
a minimal version of Steam, that is just enough to download the rest.

This is probably not something that can be fixed in the Debian steam
package: we do not have control over what is in Valve's binary-only
executables (and we can't roll back to an old version either, both
because that would probably reopen old security holes and because
it self-updates).  However, I'm involved in maintenance of the Steam
Runtime, so I might be able to get changes made in Steam eventually.

Having libraries as low-level as libmount and GLib pull in OpenSSL seems
likely to have unintended consequences like this, because OpenSSL has
a history of relatively frequent ABI breaks, and is the sort of thing
that third-party binaries will often bundle or link statically - either
because they can't rely on the host system having a version compatible
with the one they built against, or because they wanted to vendor and
maybe modify it.

The Steam Runtime goes to great lengths to use the system copy of each
library that appears to be newer than the one in the Steam Runtime,
because if it doesn't, that breaks the dependencies of graphics drivers
like Mesa, which are not really feasible to bundle with Steam.

On Fri, 26 Jun 2020 at 14:15:52 +0000, Christopher Cormier wrote:
> I've found that, even with libmount1:i386, libargon2-1:i386, and
> libcryptsetup12:i386 all installed and at their latest versions, Steam
> works *completely fine* as long as libglib2.0-0:i386 is uninstalled.

That actually makes more sense than it first appears to, because the
version of GLib in Debian depends on libmount, but the version in the
Steam Runtime doesn't. If you don't have libglib2.0-0:i386, then i386
programs will be using the old version from the Steam Runtime, which
didn't have that dependency, so they don't pull in version of OpenSSL.

    smcv